CVE-2018-6308: SQL Injection

Published Jan 25, 2018

Updated

Multiple SQL injections exist in SugarCRM Community Edition 6.5.26 and below via the track parameter to modules\Campaigns\Tracker.php and modules\Campaigns\utils.php, the defaultcurrencyname parameter to modules\Configurator\controller.php and modules\Currencies\Currency.php, the duplicate parameter to modules\Contacts\ShowDuplicates.php, the mergecur parameter to modules\Currencies\index.php and modules\Opportunities\Opportunity.php, and the loadsignedid parameter to modules\Documents\Document.php.

Affected Software

1 affected component

SugarCRM SugarCRM=6.5.26

Event History

Jan 25, 2018

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Data Sourced

via NVD·08:29 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2018-6308?

The severity of CVE-2018-6308 is critical, with a severity value of 9.8.

Which software versions are affected by CVE-2018-6308?

SugarCRM Community Edition 6.5.26 and below are affected by CVE-2018-6308.

How do I fix CVE-2018-6308?

To fix CVE-2018-6308, it is recommended to update to a version of SugarCRM Community Edition above 6.5.26.

What is the Common Weakness Enumeration (CWE) ID for CVE-2018-6308?

The CWE ID for CVE-2018-6308 is CWE-89 (SQL Injection).

Is there any additional reference documentation for CVE-2018-6308?

Yes, you can find additional reference documentation for CVE-2018-6308 at the following link: http://www.defensecode.com/advisories/DC-2018-01-011_SugarCRM_Community_Edition_Advisory.pdf